The Scam Victim’s Triage List: Secure, Document, Report (in That Order)

If you have just realized you sent cryptocurrency to a fraudulent wallet or fell for a fake investment platform, panic and shame are natural first reactions. However, acting in the correct sequence makes the difference between recovering your assets and losing all leverage. The cardinal rule for what to do if scammed crypto is resisting the urge to chase the thief or immediately post on social media. Instead, treat this like a medical emergency: secure the patient (your remaining funds), document the vitals (evidence), then call for professional help (report). This triage list—Secure, Document, Report—must be followed in that exact order to maximize your chances of recovery.

1. Secure: Stop the Bleeding First

Your immediate priority is protecting any funds the scammer has not yet taken. Crypto transactions are irreversible, but you can still lock down unaffected assets.

• Move remaining crypto to a new, hardware-based wallet. Create a fresh wallet using a reputable non-custodial service (like Ledger or Trezor hardware, or software such as Trust Wallet). Transfer all residual coins from compromised exchanges or hot wallets to this new address. Do not reuse old private keys or seed phrases.
• Revoke smart contract approvals. If you connected your wallet (e.g., MetaMask, Phantom) to a suspicious dApp or investment site, the scammer may have unlimited approval to drain tokens. Use a revoke tool like Etherscan’s “Token Approvals” or Revoke.cash to cancel all permissions.
• Change passwords and enable 2FA on every exchange account. Assume the scammer has your credentials. Use a password manager to generate unique, complex passwords. Avoid SMS-based two-factor authentication; use an authenticator app (Google Authenticator, Authy) or a hardware key instead.
• Scan your devices for malware or remote access tools. Scammers often install keyloggers or RATs. Run full antivirus and anti-malware scans on all computers and phones used for crypto transactions. Consider a factory reset if you suspect persistent compromise.

Securing first prevents a second wave of losses. Many victims lose more money after the initial scam because they neglect to revoke approvals or leave funds in a connected wallet. Once your remaining assets are safe, you can methodically move to documentation.

2. Document: Build Your Evidence File

With your funds secured, gather every piece of digital evidence. Law enforcement, lawyers, and recovery firms cannot act on vague memories—they need a verifiable data trail.

What to collect immediately:

• Transaction hashes (TXIDs) from the blockchain for every transfer to the scammer. Use block explorers like Etherscan, BscScan, or Solscan to locate the outgoing transactions. Copy the full hash and the sending/receiving wallet addresses.
• Screenshots and screen recordings of the scam website, the investment platform, chat logs (Telegram, Discord, WhatsApp), email exchanges, and any error messages. Capture the full URL bar showing the exact domain name.
• Timestamps and amounts – note the date, time (including time zone), and fiat value of each transaction. Convert crypto amounts to USD at the time of transfer using a historical price tool.
• Communication logs – export entire chat histories, including deleted messages if possible. Save scammer profiles, usernames, phone numbers, and email addresses.
• Wallet addresses associated with the scammer. Check if those addresses have been flagged by blockchain analytics tools (e.g., Chainabuse, CryptoScamDB).

How to organize your evidence:

• Create a dedicated folder on a clean external drive or cloud storage (Google Drive encrypted). Name files by date and type: “2026-03-30_TXID_hash.png” or “2026-03-28_Telegram_log.txt”.
• Write a chronological timeline of events: when you first contacted the scammer, when you sent each payment, what promises were made, and when communication stopped.
• Do not alter, edit, or rename transaction hashes. Preserve raw data exactly as you retrieved it.

Thorough documentation transforms a hopeless situation into an actionable case. It also helps you avoid wasting time on “recovery” scammers who will contact you next—demand proof of loss before anyone claims they can help.

3. Report: Notify the Right Authorities (Including Professionals)

Only after securing your assets and documenting everything should you report the crime. Reporting in the wrong order (e.g., telling the scammer you are going to the police) may cause them to destroy evidence or move funds. Follow this escalation path:

• File with local police – Provide your documentation and timeline. Request a police report or incident number. Even if officers lack crypto expertise, the official record is necessary for banks and future legal actions.
• Report to national cyber units – In the US, file with the FBI’s IC3 (ic3.gov) and the FTC (reportfraud.ftc.gov). In the UK, use Action Fraud. In Canada, the CAFC. In Australia, ReportCyber. Include your TXIDs and wallet addresses.
• Notify the exchange – If you sent funds from a centralized exchange (Coinbase, Binance, Kraken), inform their support team immediately. They may freeze the scammer’s account if the funds are still there.
• Flag the scammer’s wallet addresses on blockchain reputation platforms like Chainabuse, Etherscan’s comments section, or CryptoScamDB. This helps other potential victims.
• Engage a professional asset recovery firm – When official channels are slow or unable to trace cross-jurisdictional fraud, specialized firms add investigation and legal pressure. These experts use forensic blockchain analysis, exchange liaison, and legal demand letters.

If you are still asking what to do if scammed crypto after following the steps above—or if the scam involved significant funds and complex laundering—professional assistance is your next logical move. Firms like Radley Assist specialize in fund recovery, broker verification, asset tracing, and financial fraud investigation. They work with victims to navigate regulatory complaints, identify hidden assets, and engage legal support across jurisdictions. Remember: legitimate recovery firms never demand upfront fees in crypto or ask for your private keys. Follow this triage list in order, and you will transform chaos into a structured path toward justice.